feat: session and act spans via plugin hooks

[ajbozarth]

Background

Session-level and act-level spans are currently emitted via direct trace_application(...) calls in mellea/stdlib/session.py and mellea/stdlib/functional.py. This leaks tracing concerns into stdlib.

Replaces retired sub-issue #470.

Scope

• Move session-context span emission into a session-lifecycle hook consumed by a plugin in tracing_plugins.py. (If no suitable session-lifecycle hook exists, open a small prerequisite issue in mellea/plugins/ to add one; prefer reusing existing hooks.)
• Move aact span emission into a plugin hooked on the appropriate pre/post action hook. Preserve existing attributes but add mellea. prefix (per refactor: rename tracing env vars to plural and align with OTel semconv #1046).
• Remove trace_application, set_span_attribute imports from stdlib/session.py and stdlib/functional.py.
• Consider adding gen_ai.conversation.id on session spans (overlaps with OTel omissions/gaps: chat content events, gen_ai.conversation.id, prompt templates, error status #1035 — coordinate with PR feat(telemetry): close five OTel GenAI semantic convention emission gaps (#1035) #1036).

Phase & dependencies

Phase 2 (coverage). Depends on Phase 1 (#1045, #1046, #1047). Can proceed in parallel with #1049, #1050, #1051, #1052, and with PR #1036 rebased onto Phase 1.

Acceptance criteria

• mellea/stdlib/ no longer imports from mellea.telemetry.tracing.
• Session → aact → backend span hierarchy preserved.
• Tests cover parent-child span relationships.

Parent epic: #444

[ajbozarth]

While going through PR #1181 review, surfaced a privacy bug from
@planetf1 that's in scope for this issue:

mellea.response (set in aact at stdlib/functional.py:707) currently
captures up to 500 chars of model output unconditionally — it doesn't gate
on is_content_tracing_enabled() / MELLEA_TRACES_CONTENT. Pre-existing
leak, but PR #1181 makes MELLEA_TRACES_CONTENT user-visible in the docs,
which turns this from undocumented behavior into a documented broken
contract.

Disposition: not fixing in #1181 because the inline emission code is what
this issue replaces. When moving aact span emission to the new plugin,
the mellea.response capture should be gated on
is_content_tracing_enabled(). mellea.response_length is fine to keep
ungated (a non-content metric).

Original review comment: #1181 (comment)